What Is CUI and Why It Matters for AI
Controlled Unclassified Information (CUI) includes any information the U.S. government creates or possesses that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. For defense contractors, this includes contract numbers, technical specifications, personnel data, procurement-sensitive information, and more.
The CUI Registry (cui.gov) lists 125 CUI categories. If you handle DoD contracts, you almost certainly handle CUI.
How CUI Gets Into ChatGPT (And How to Stop It)
The three most common CUI leakage patterns in defense contractor organizations:
- Document summarization: Engineer uploads a contract document to get a summary. Contract contains CUI.
- Code completion: Developer asks AI to generate code, includes variable names that contain contract identifiers.
- Report drafting: Program manager uses AI to draft a status report, pastes in project details.
The Technical Solution: Local AI Proxy
HoundShield intercepts every AI API call before it leaves your network. It runs pattern matching against 200+ CUI indicators (CAGE codes, contract numbers, classification markings, clearance levels, PHI markers) in under 10ms. Blocked requests never reach the external AI service. Every decision creates an immutable log entry.
Setup is one line: point your AI tool's API base URL to your Kaelus endpoint instead of api.openai.com. No code changes. No agent installation on every machine. One network-level change covers your entire organization.